Remove & -> &mut transmutation from libarena

Changes both `Arena` and `TypedArena` to contain an inner struct wrapped in a `Unsafe`, and change field access to go through those instead of transmuting `&self` to `&mut self`.

Part of #13933
This still feels unsafe... especially with the closure like this, since one could write

```rust
let some_arena = ...;

some_arena.alloc(|| {
    some_arena.alloc(|| {
        // uh oh: two &mut's to some_arena.inner, both being mutated.
    });

    foo()
})
```